multer CVE-2026-77078

No special configuration or non-default setup is required: any application that uses multer versions before 2.3.0 to process multipart/form-data on a network-accessible endpoint is exploitable by unauthenticated attackers (CVSS PR:N, AV:N, AC:L). The payload is small and unremarkable in size, making it unlikely to trip size-based filters. Exploitation outcome is strictly denial-of-service - there is no confidentiality or integrity impact. The primary limiting factors are: (1) the target application must expose at least one HTTP endpoint that invokes multer to parse incoming multipart requests; applications that gate all such endpoints behind authentication (login-required upload forms) can only be attacked by authenticated users, reducing the threat surface. (2) After process termination, a process manager such as PM2 or systemd may automatically restart the process, potentially allowing an attacker to repeatedly trigger crashes in a sustained DoS loop.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the vulnerability's characteristics: network-accessible, no authentication, no user interaction, and low attack complexity producing high availability impact with no confidentiality or integrity compromise. The scoped impact designation (S:U) is arguably understated - crashing the Node.js process terminates all services co-located in that process, not merely multer's own functionality. EPSS data is absent from the available intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing has been identified, and no public exploit code exists at time of analysis, meaning this is not confirmed actively exploited. However, the low barrier to exploitation - a small two-field HTTP body, no credentials, no special timing - means the attack is trivially automatable against any exposed multipart endpoint; the absence of observed exploitation should not be confused with the absence of risk. The risk is operational continuity rather than data exfiltration, but for availability-sensitive services, the effort to upgrade to 2.3.0 is far lower than the cost of a process-killing attack.

An unauthenticated attacker identifies an internet-facing Node.js application that uses multer to process file uploads or form submissions. The attacker sends a single HTTP POST with a multipart/form-data body containing two crafted text fields - one with an extremely large numeric array-index name and a second designed to overflow the resulting sparse array - which requires no special tooling beyond a standard HTTP client. The Node.js process throws an uncaught RangeError and terminates immediately, rendering the entire application unavailable until an operator manually restarts the process.